P1049S/ST (2002-6 11 79) 

F.Nf RVPTION APPARATUS AND METHOD IN A WIRELESS 
COMMUNICATIONS SYSTEM 

PRIORITY 

This application claims priority under 35 U.S.C. § 119 to an application 
entitled "Encryption Apparatus and Method in a Wireless Communications 
System" filed in the Korean Industrial Property Office on October 8, 2002 and 
assigned Serial No. 2002-61179, the contents of which are incorporated herein by 
reference. 



BACKGROUND OF THE INVENTION 



1 . Field of the Invention 
15 The present invention relates generally to a wireless communications 

system, and in particular, to an encryption apparatus and method for 
implementing confidentiality and integrity algorithms in a wireless 
communications system. 

20 2. Description of the Related Art 

has evolved into the 

AS Hie IirSl gcncittuun attain vuvi^^vxx ~j 

second generation digital encryption system, more advanced encryption 
techniques have been used. The current third generation encryption system 
provides encryption service for multimedia service i.e., audio and video 
25 information. Thus, the importance of encryption has increased in order to provide 
confidentiality to voice signals, multimedia service, and user data. An integrity 
algorithm is required to authenticate control signals between mobile terminals in 
a wireless communication system and a network. The 3 rd Generation Project 
Partnership (3 GPP) has selected the KASUMI algorithm as the f8 confidentiality 
30 and f9 integrity algorithms for a third generation system based on a Global 
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System for Mobile communication (GSM) core network, and a Universal Mobile 
Telecommunication System (UMTS). 

FIG. 1 is a block diagram illustrating an example of a conventional 
5 KASUMI algorithm. Referring to FIG. 1, KASUMI is an 8-round Feistel unit 
cipher that provides a 64-bit output ciphertext from a 64-bit input plaintext with 
8-round encryption. The 64-bit input signal is divided into a 32-bit signal L 0 and 
a 32-bit signal Ro- FLi units (l<i<8) 110 to 180 and FOi units (l<i<8) 210 to 280 
encrypt the signals L 0 and Ro under corresponding encryption keys KLj (l<i<8), 
10 KOi (l<i<8), and KI ; (l<i<8) and output the 64-bit ciphertext. 

Encryption in accordance with FIG. 1 occurs in the following manner. An 
FLI unit 110 encrypts the input 32-bit signal L 0 with an encryption key KL, and 
outputs a ciphertext L 01 . An FOI unit 210 encrypts the 32-bit ciphertext L 01 with 
15 encryption keys KO, and KI, and outputs a ciphertext L 02 . An Exclusive-OR 
operation is performed to logically "exclusive OR" the ciphertext L 02 and the 32- 
bit signal Ro to provide a 64-bit ciphertext. This encryption occurs eight times 
and a final 64-bit ciphertext is generated in the KASUMI. 

20 FIG. 2A is a block diagram illustrating an example of FOi units. 

. -^1. i-r\ Uo CAi unit c.mnnrises a 

Referring to FIG. 2 A, FOi denotes an iiu umu — 

plurality of Fly sub-ciphers (l<i<3, l<i<3) to provide 3-rounds of encryption. 
Here, the operation of the FOI unit 210 will be described by way of example. 
The 32-bit input signal is divided into two 16-bit signals L 0 and Ro- An 
25 Exclusive-OR operation is performed to logically "exclusive OR" the 16-bit 
signal L 0 and a 16-bit sub-encryption key KO u , to provide a signal L,. A Fl,., 
sub-cipher 201 encrypts the signal L, with a 16-bit sub-encryption key KI,., and 
outputs a signal L, D . Meanwhile, a first delay (D,) 10 delays the 16-bit signal Ro, 
which is equivalent to the signal R„ in order to synchronize the 16-bit signal R« 
30 with the signal L, D and output a delayed signal R, D . For a second-round of 
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encryption, an Exclusive-OR operation is performed to logically "exclusive OR" 
the 16-bit signal R 1D and a 16-bit sub-encryption key KO,, 2 to provide a signal 
L 2 . A Fl, 2 sub-cipher 203 encrypts the signal L 2 with a 16-bit sub-encryption key 
KI I2 and outputs a signal L 2D . Meanwhile, an Exclusive-OR operation is 
5 performed to logically "exclusive OR" the 16-bit signal Rid and the signal L 1D , to 
provide a signal R 2 . A second delay (D 2 ) 20 delays the signal R 2 in order to 
synchronize the signal R2 with the signal L 2D and output a delayed signal R 2D . 
For a third-round of encryption, an Exclusive-OR operation is performed to 
logically "exclusive OR" the 16-bit signal R 2D and a 16-bit sub-encryption key 
10 KO, 3 , resulting in a signal L 3 . A Fl,, 3 sub-cipher 205 encrypts the signal L 3 with 
a 16-bit sub-encryption key KI,, 3 and outputs a signal L 3D . Meanwhile, an 
Exclusive-OR operation is performed to logically "exclusive OR" the 16-bit 
signal R 2D and the signal L 2D to provide a signal R 3 . A third delay (D 3 ) 30 delays 
the signal R 3 in order to synchronize the signal R 3 with the signal L 3D and output 
15 a delayed signal R 3D . An Exclusive-OR operation is performed to logically 
"exclusive OR" the 16-bit signal R 3D and the signal L 3D , to provide a signal R, 
The 16-bit signal R, is operated with the 16-bit signal R 3D (=L 4 ), resulting in a 
32-bit ciphertext L 4 // R4. 

20 The FOl unit uses the three delays 10, 20 and 30 to synchronize to the 

output timings of the sub-ciphers 201, 203 and 205. 

FIG. 2B is a block diagram illustrating another example of the FOi units. 
Referring to FIG. 2B, a FOi unit comprises a plurality of F1 PJ > sub-ciphers 

25 (l<i'<3 1<T<3), for 3-rounds of encryption. Here, the FOI unit 210 will be 
described by way of example. The 32-bit input signal is divided into two 16-bit 
signals L 0 . and Ro- An Exclusive-OR operation is performed to logically 
"exclusive OR" the 16-bit signal L 0 > and a 16-bit sub-encryption key KO,,,, to 
provide a signal L r . A Fl, ,,. sub-cipher 211 encrypts the signal L,- with the 16- 

30 bit sub-encryption key KI,,, and outputs a signal L, D . Meanwhile, a fourth delay 
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(D 4 ) 40 delays the 16-bit signal Ro> (=Rr) and outputs a delayed signal R, D . An 
Exclusive-OR operation is performed to logically "exclusive OR" the signals 
L 1D > and R 1D > to provide a signal L r . Simultaneously, an Exclusive-OR operation 
is performed to logically "exclusive OR" the 16-bit signal R<r and a 16-bit sub- 
5 encryption key KO,, 2 , to provide a signal R 2 >. A Fl r , r sub-cipher 213 encrypts 
the signal R 2 > with a 16-bit sub-encryption key KI,, 2 and outputs a signal R 2D >. An 
Exclusive-OR operation is performed to logically "exclusive OR" the signals L 2 - 
and R 2D ' to provide a signal R 3 >. Another Exclusive-OR operation is performed to 
logically "exclusive OR" the signal L 2 > and a 16-bit sub-encryption key KO,, 3 , to 
10 provide a signal L v . A Fl 1%3 > sub-cipher 215 encrypts the signal L r with a 16-bit 
sub-encryption key KI,, 3 and outputs a signal L 3D <. Meanwhile, a fifth delay (D 5 ) 
50 delays the signal R 3 > and outputs a delayed signal R 3D >. An Exclusive-OR 
operation is performed to logically "exclusive OR" the signals L 3D > and R 3D - to 
provide a 16-bit signal L 4 >. The 16-bit signal L 4 - is operated with the 16-bit signal 
15 R 3D ' (=R4-), resulting in a 32-bit ciphertext L^/R^. 

The above advanced FOi unit uses the two delays 40 and 50 to 
synchronize to the output timings of the Fl sub-ciphers 211 and 215. However, 
due to the use of the delays, a large chip capacity is required. 

20 

the Fl; ; sub-cinhers 

JTlO. ^ IS a UlUUis. uiagiam iiiujiiutin & — x — ~- hi 

illustrated in FIGs. 2A and 2B. By way of example, the Fl,,, sub-cipher 201 will 
be described below. Referring to FIG. 3, the 16-bit input signal is divided into a 
9-bit signal RLo and a 7-bit signal RRq- An SBox91 (S91) operator 310 generates 
25 a 9-bit signal yO, yl, . . ., y8 from the input signal RL 0 using 
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S SSoxiex2x3*xOx4exlx4exOx5«x3x5©x«®xlx7®x2x7€*5x8ei 

yi I X0*xlx2^0xj@x2x4*x5©x0x6#xlx6^4x7ex0x8®xlxs«bc7x8 
v4 xOxl€)x] x3ex4ex0xS^x3xS®x0x7©x€x7®xlxa@x2xB©x3x8 

yfl = X 0xl®x2©Xlx2«x3X4^Xlx5«x2x5®XlXfiffix4x6®x7®x2xS®x3x8 

(1) 

A ZE1 unit 320 receives the signal RRo, adds two zeroes to the Most 
5 Significant Bit (MSB) of the signal RRo, and outputs a 9-bit signal. An 
Exclusive-OR operation is performed to logically "exclusive OR" the outputs of 
the S91 operator 310 and the ZE1 unit 320 to provide a 9-bit signal RL,. Another 
Exclusive-OR operation is performed to logically "exclusive OR" the signal RL, 
and a 9-bit sub-encryption key KI,,,, 2 , to provide a 9-bit signal RL 2 . 



10 



15 



A TR1 unit 330 removes two zero bits from the MSBs of the 9-bit signal 
RL,. An SBox71 (S71) operator 340 generates a 7-bit signal yO, yl, . . ., y6 from 
the input signal RRo (=RR,) by 

yO .xLx3©x4©x0xlx4©xS©x2x5@x3x4x5©x6©xQx6©xlx6©x3x6©x2x4x6©xlx5x6 

©x4x5x6 

yl »x0xl©x0x4©x2x4©x5©xlx2x5©x0x3x5©x6©x0x2x6©x3x6©x4x5x6©l 
y2 .xQ©xOx3©x2x3©xlx2x4©x()x3x4©xlx5©xOx2x$©xOx6©x0xlx6©x2x6©x4x6©l 
y3 mxt©xOxlx2©xlx4©x3x4©x0xS©xOxlxS©x2x3x5©xlx4x5©x2x6©xlx3x6 
y4 «x0x2©x3©xlx3©xlx4©x0xlx4©x2x3x4©x0x$©xlx3x5©x0x4x5©xlx6©x3x6 

©X0x3x6ffix5x6©l 

yS «x2©x0x2©xQx3©xlx2x3©x0x2x4©x0x$©x2x5©x4x5©xlx6©xix2x6©xOx3x6 

©X3x4x6©x2x5x6©l 

y6 «xlx2©x0xlx3©x0x4©xLx5©x3xSex6©xQxlx6©x2x3x6©xlx4x$©xOx5x6 ( 

(2) 

An Exclusive-OR operation is performed to logically "exclusive OR" the 
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outputs of the TR1 330 and the S71 operator 340 via a sub-encryption key 
KI u ,i, to provide a 7-bit signal RR 2 . 

A SBox92 (S92) operator 350 generates a 9-bit signal yO, yl, . . ., y8 
5 from the signal RL 2 by Eq. (1). A ZE2 unit 360 receives the signal RR„ adds two 
zeroes to the MSB of the signal RR„ and outputs a 9-bit signal. An Exclusive- 
OR operation is performed to logically "exclusive OR" the outputs of the S92 
operator 350 and the ZE2 unit 360 to provide a 9-bit signal RL 3 . A TR2 unit 370 
removes two zero bits from the MSBs of the 9-bit signal RL 3 . A SBox72 (S72) 
10 operator 380 generates a 7-bit signal yO, yl, . . ., y6 from the input signal RR 2 
(=RR 3 ) using Eq. (2). Another Exclusive-OR operation is performed to logically 
"exclusive OR" the outputs of the TR2 370 and the S72 operator 380 to provide a 
7-bit signal RR4. 

15 The 9-bit signal RL 3 (=RL 4 ) and the 7-bit signal RR4 are operated, 

resulting in a 16-bit ciphertext RL4//RR4. 

As described above, the S91 operator 310 and the S92 operator 350 each 
sequentially perform an AND operation to perform a logical "AND" and an 
20 exclusive-OR operation to perform a logical "Exclusive-OR" using Eq. (1), to 

.1 ..1 ,,0 c;tr.;wK; thp S71 onerator 340 
thereby generate an output signal yu, yi, . • 

and the S72 operator 380 sequentially perform an AND operation to perform a 
logical "AND" and an exclusive-OR operation to perform a logical "Exclusive- 
OR" using Eq. (2), to thereby generate an output signal yO, yl, . . ., y6. 
25 Consequently, the encryption speed is decreased. Moreover, a gate delay 
involved in the operations of the S91, S92, S71 and S72 operators 310, 350, 340, 
and 360 gradually increases glitch. 

SUMMARY OF THE INVENTION 

30 It is, therefore, an object of the present invention to provide an 
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encryption method for generating a ciphertext bit stream of length 2n from a 
plaintext bit stream of length 2n. 

It is another object of the present invention to provide an encryption 
5 apparatus for generating a ciphertext bit stream of length 2n from a plaintext bit 
stream of length 2n. 

To achieve the above objects, in an encryption method for dividing a first 
plaintext bit stream of length 2n into first and second sub-bit streams of length n, 
10 dividing a second plaintext bit stream of length 2n into third and fourth sub-bit 
streams of length n, and generating a ciphertext bit stream of length 2n from the 
first, second, third and fourth sub-bit streams using 2-rounds of encryption, first 
and second ciphertext bit streams of length n are generated by encrypting the first 
and second sub-bit streams with predetermined first encryption codes KO,,,, 
15 KO,, 2 , KO,, 3 , KI,.,, KI,, 2 , and KI 1>3 , the second ciphertext bit stream being output 
with a predetermined time delay from the first ciphertext bit stream, in a first- 
round encryption. A first operated ciphertext bit stream is generated by 
performing a logical exclusive-OR-operation on the first ciphertext bit stream 
and the third sub-bit stream, and a second operated ciphertext bit stream is 
20 operated by performing a logical exclusive-OR-operation on the second 

, i ^ a **™,*+Vi cnK-Kit Qtrpam Tn a second-round of 

CipneneXl OIL stream anu iwuiiu — 

encryption, third and fourth ciphertext bit streams of length n are generated by 
encrypting the first operated ciphertext bit stream and the second operated 
ciphertext bit stream with predetermined second encryption codes K0 2 ,i, K0 2 , 2 , 
25 K0 2 ,3, KI 2>1 , KI 2 , 2 , and KI 2 , 3 and the third and fourth ciphertext bit streams are 
concurrently output. 

In an encryption apparatus for dividing a first plaintext bit stream of 
length 2n into first and second sub-bit streams of length n, dividing a second 
30 plaintext bit stream of length 2n into third and fourth sub-bit streams of length n, 



-7- 



P10495/ST (2002-61179') 



and generating a ciphertext bit stream of length 2n from the first, second, third 
and fourth sub-bit streams using 2-rounds of encryption, a first ciphering unit 
receives the first and second sub-bit streams, and generates first and second 
ciphertext bit streams of length n by encrypting the first and second sub-bit 
5 streams with predetermined first encryption codes KO M , KO,, 2 , KO,, 3 , KI M , 
KI 12 , and KI,, 3 . Here, the second ciphertext bit stream is output with a 
predetermined time delay from the first ciphertext bit stream. An operating unit 
generates a first operated ciphertext bit stream by performing a logical exclusive- 
OR operation on the first ciphertext bit stream and the third sub-bit stream, and 
10 generates a second operated ciphertext bit stream by performing a logical 
exclusive-OR-operation on the second ciphertext bit stream with the fourth sub- 
bit stream. A second ciphering unit receives the first operated ciphertext bit 
stream and the second operated ciphertext bit stream having the predetermined 
time delay, generates third and fourth ciphertext bit streams of length n by 
15 encrypting the first operated ciphertext bit stream and the second operated 
ciphertext bit stream with predetermined second encryption codes K0 2 ,„ K0 2 , 2 , 
K0 2 , 3 , KI 2 ,„ KI 2 , 2 , and KI 2 , 3 and concurrently outputs the third and fourth 
ciphertext bit streams. 



20 



BRIEF DESCRIPTION OF THE DRAWINGS 



The above and other objects, features and advantages of the present 
invention will become more apparent from the following detailed description 
when taken in conjunction with the accompanying drawings in which: 
25 FIG. 1 is a block diagram illustrating an example of a conventional 

KASUMI algorithm; 

FIG. 2A is a block diagram illustrating an example of FOi units 

illustrated in FIG. 1; 

FIG. 2B is a block diagram illustrating another example of the FOi units 

30 illustrated in FIG. 1; 
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FIG. 3 is a block diagram illustrating an example of Flj, 3 sub-ciphers 

illustrated in FIGs. 2A and 2B; 

FIG. 4 is a block diagram illustrating an example of a KASUMI 

algorithm according to the present invention; 
5 FIG. 5 is a block diagram illustrating an example of SLIMFOi units 

illustrated in FIG. 4 according to the present invention; and 

FIG. 6 is a block diagram illustrating an example of Fl i( j sub-ciphers 
illustrated in FIG. 5 according to the present invention. 

10 DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

An embodiment of the present invention will be described herein below 
with reference to the accompanying drawings. Also, a description of known 
functions and configurations have been omitted for conciseness. 

15 

A KASUMI algorithm according to the present invention is a ciphering 
algorithm used as the ffi confidentiality and f9 integrity algorithms. The ft 
confidentiality algorithm encrypts a plaintext signal having a predetermined 
number of bits by exclusive-OR-operating the plaintext with an encryption key 
20 and decrypts a ciphertext by exclusive-OR-operating the ciphertext with the 

i • ~ „r,nm± ontV-i^ntiratinn rode 

encryption key. The f9 integrity algoritnm aenvcs -a uraaagw —~ — 

from a received signal. The KASUMI algorithm, as previously discussed, has 
emerged as a significant issue to confidentiality and integrity. 

25 FIG. 4 is a block diagram illustrating an example of a KASUMI 

algorithm according to the present invention. Referring to FIG. 4, a KASUMI of 
the present invention provides a 64-bit output ciphertext from a 64-bit input 
plaintext using first, second and third encryption keys. The 64-bit input signal is 
divided into a 32-bit signal L 0 and another 32-bit signal R* FLi units (l<i<8) 410 
30 to 480 and SLIMFOi units (l<i<4) 510 to 540 are used to encrypt the signals L 0 
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and Ro using corresponding encryption keys KOi (l<i<8) and Klj (l<i<8) to 
output a 64-bit ciphertext. 

Describing FIG. 4 in more detail, an FL1 unit 410 encrypts the input 32- 
5 bit signal L 0 with an encryption key KL, and outputs a ciphertext L,. An 
SLIMFOl unit 510 encrypts the 32-bit ciphertext L, with encryption keys KO, 
and KI,, outputs a signal SR, by encrypting the signal L, with the 32-bit signal 
Ro, and then outputs a signal R, by encrypting the signal SR, with encryption 
keys K0 2 and KI 2 . An FL2 unit 420 encrypts the signal R, with an encryption 
10 key KL 2 and outputs a ciphertext R 2 . An Exclusive-OR operation is performed to 
logically "exclusive OR" the signals L 0 and R 2 to provide a signal L 2 (=SL,). 

An FL3 unit 430 encrypts the signal L 2 with an encryption key KL 3 and 
outputs a ciphertext L 3 . An SLIMF02 unit 520 encrypts the signal L 3 with 

15 encryption keys K0 3 and KI 3 , outputs a signal SR 2 by operating the encrypted 
signal L 3 with the signal SR,, and then outputs a signal R 3 by encrypting the 
signal SR 2 with encryption keys K0 4 and KI 4 . An FL4 unit 440 encrypts the 
signal R 3 with an encryption key KL 4 and outputs a ciphertext R4. An Exclusive- 
OR operation is performed to logically "exclusive OR" the signals L 2 (=SL,) and 

20 R4 to provide a signal L 4 (=SL 2 ). 

An FL5 unit 450 encrypts the signal L 4 with an encryption key KL 5 and 
outputs a ciphertext L 5 . An SLIMF03 unit 530 encrypts the signal L 5 with 
encryption keys K0 5 and KI 5 , outputs a signal SR 3 by operating the encrypted 
25 signal L 3 with the signal SR 2 , and then outputs a signal R 5 by encrypting the 
signal SR 3 with encryption keys K0 6 and KI 6 . An FL6 unit 460 encrypts the 
signal R 5 with an encryption key KL 6 and outputs a ciphertext R*. An Exclusive- 
OR operation is performed to logically "exclusive OR" the signals L 4 (=SL 2 ) and 
R^ to provide a signal L 6 (=SL 3 ). 

30 
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An FL7 unit 470 encrypts the signal L 6 with an encryption key KL 7 and 
outputs a ciphertext L 7 . An SLIMF04 unit 540 encrypts the signal L 7 with 
encryption keys KO ? and KI 7 , outputs a signal SR» by operating the encrypted 
signal L 7 with the signal SR 3 , and then outputs a signal R 7 by encrypting the 
5 signal SR4 with encryption keys KO g and KI 8 . An FL8 unit 480 encrypts the 
signal R 7 with an encryption key KL 8 and outputs a ciphertext R 8 . The signals L 6 
(=SL 3 ) and R 8 are exclusive-OR-operated, resulting in a signal L 8 (=SL 4 ). 
Consequently, the eight FLi units (l<i<8) 410 to 480 and the four SLIMFOi units 
(l<i<4) 510 to 540 encrypt the 64-bit plaintext and output the 64-bit ciphertext, 
10 that is, the 32-bit signal SL 4 //the 32-bit SR». 

FIG. 5 is a block diagram illustrating an example of the SLIMFOi units 
illustrated in FIG. 4 according to an embodiment of the invention. Referring to 
FIG. 5, a SLIMFOi unit is an ith SLIMFO unit and implemented using parallel 
15 operations of signals in two FOi units. The SLIMFOI unit 510 of FIG. 4 will be 
described by way of example. The SLIMFOI unit 510 comprises an FOI cipher 
501 and an F02 cipher 502. Each FO cipher includes Fljj sub-ciphers (l<i<2, 
l<j<3), for 3-round encryption. 

20 The signal resulting from encrypting the 32-bit signal L 0 with the 

, , t a — 1 o 1 ^;_K;t cicmnl T « V=T .0 and a 16-bit 

encryption key KM in no. t is uiviucu miu u. i« d»* — e> » v 

signal Ro (=Ri) in the FOI cipher 501. A signal L 2 is generated by performing a 
logical exclusive-OR operation on the signal L, with a sub-encryption key KO,,,. 
An Fl,,, sub-cipher 511 generates a signal L 2D by encrypting the signal L 2 with a 
25 sub-encryption key KI U . A delay (D6) 600 delays the signal R, and outputs a 
delayed signal R 1D . A signal L 3 is generated by performing a logical exclusive- 
OR operation on the signals R 1D and L 2D . Meanwhile, a signal R 2 is generated by 
performing a logical exclusive-OR operation on the signal R, with a sub- 
encryption key KO,, 2 . An FL 1>2 sub-cipher 512 generates a signal R 2D by 
30 encrypting the signal R 2 with a sub-encryption key KI 1>2 . A signal R 3 is generated 
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by performing a logical exclusive-OR operation on the signals R 2D and L 3 . A 
signal U is generated by performing a logical exclusive-OR operation on the 
signal U with a sub-encryption key KO,, 3 . An Fl,, 3 sub-cipher 513 generates a 
signal L 4D by encrypting the signal L 4 with a sub-encryption key KI 1>3 . A delay 
5 (D7) 620 delays the signal R 3 and outputs a delayed signal R 3D . A 16-bit signal 
L 5 is generated by performing a logical exclusive-OR operation on the signals 
R 3D and L 4D - 

The 32-bit signal Ro which was divided from the 64-bit signal in FIG. 4 
10 is further divided into a 16-bit signal L 0 » and a 16-bit signal Re in the F02 cipher 
502. A signal L 6 is generated by performing a logical exclusive-OR operation on 
the signal L 0 > using the 16-bit signal L 5 . Meanwhile, a signal R, is generated by 
performing a logical exclusive-OR operation on the signal Ro' using the 16-bit 
signal R 3 . A signal R 5 is generated by performing a logical exclusive-OR 

15 operation on the signal R4 using a sub-encryption key K0 2(1 . An Fl 2)1 sub-cipher 
514 generates a signal R 5D by encrypting the signal R 5 with a sub-encryption key 
KI 2 ,i. A signal R* is generated by performing a logical exclusive-OR operation on 
the signals R 5D and L 6 . That is, the Fl,, 3 sub-cipher 513 and the Fl 2 ,, sub-cipher 
514 synchronize the signal L 6 to the signal Rs without using delays. A signal L 7 is 

20 generated by performing a logical exclusive-OR operation on the signal L 6 with a 

.• 1 tjrr\ a „ ttt . ^.iK-^irth^r ^1^ opnf.rate.s a sienal Tin 

16-bit suD-encrypiion Key jvw 2 2 . rvu 1^2,2 — - & °~ 

by encrypting the signal T 7 with a 16-bit sub-encryption key KI 2 , 2 . A delay (D8) 
640 delays the signal Re and outputs a delayed signal V^ D . A signal T 8 is 
generated by performing a logical exclusive-OR operation on the signals T 7D and 

25 R6D- A signal R 7 is generated by performing a logical exclusive-OR operation on 
the signal R« with a 16-bit sub-encryption key K0 2 , 3 . An Fl 2 , 3 sub-cipher 516 
generates a signal R 7D by encrypting the signal R 7 with a 16-bit sub-encryption 
key KI 2 , 3 . A signal R 8 is generated by performing a logical exclusive-OR 
operation on the signals R 7D and T 8 . Consequently, a 32-bit ciphertext L 8 II R 8 is 

30 generated by operating the 16-bit signal T 8 with the 16-bit signal R 8 . 
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As described above, the SLIMFOl unit encrypts the input plaintext by 
processing the 16-bit signals L 0 and Ro in parallel in the FOl cipher 501 and 
processing the 16-bit signals L<y and Ro- in parallel in the F02 cipher 502. The 
5 parallel processing of the 32-bit signals L 0 and Ro which were divided from the 
64-bit input signal in the SLIMFOi units remarkably increases encryption speed 
and reduces the number of delays used to synchronize a delayed signal to a non- 
delayed signal. 

10 FIG. 6 is a block diagram illustrating an example of the Fly sub-ciphers 

illustrated in FIG. 5 according to an embodiment of the invention. By way of 
example, the Fl,,, sub-cipher 511 will be described below. 



Referring to FIG. 6, the Fl,,, sub-cipher 511 includes a first 
15 ciphering unit and a second ciphering unit. In the first ciphering unit, a 16- 
bit input signal is divided into a 9-bit signal RL 0 and a 7-bit signal RRo- An 
S91 operator 710 generates a 9-bit signal yO, yl, . . ., y8 from the input 
signal RL 0 by 

y3 = 20©felxy©(^s3)(!*x2xS)€&5^ 
y4 = (jd)Kl®(xtx3)©x4®(xflx5)e^ 

y8 = (d x l)©x2®(xl32)$(x3x4)S<x^ 



20 



.... (3) 

That is, the S91 operator 710 generates the 9-bit signal yl, y2, . . ., y8 by 

- 13- 



P 1 0495/ST (2002-6 1179) 

performing parallel logical AND operations and then performing a logical 
exclusive-OR operation of a 9-bit signal xO, xl, . . ., x8 in parallel. A ZE1 unit 
720 receives the signal RRo, adds two zeroes to the MSB of the signal RRo, and 
outputs a 9-bit signal. An Exclusive-OR operation is performed to logically 
5 "exclusive OR" the outputs of the S91 operator 710 and the ZE1 unit 720 to 
provide a 9-bit signal RL,. Another Exclusive-OR operation is performed to 
logically "exclusive OR" the signal RL, and a 9-bit sub-encryption key KI,, 1>2 , to 
provide a 9-bit signal RL 2 . The signal RL 2 is temporarily stored in a first register 
(register 1) 800. 

10 

Simultaneously, an S71 operator 740 generates a 7-bit signal yO, yl, . . 
y6 from the input signal RRo (=RRi) by 
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yNxDri) 



(4) 



That is, the S71 operator 740 generates the 9-bit signal yl, y2, . . ., y6 by 
performing parallel logical AND operations and then performing a logical 
exclusive-OR operation of a 7-bit signal xO, xl, . . ., x6 in parallel. A TR1 unit 
20 730 removes two zeroes from the MSBs of the 9-bit signal RL, and outputs the 
resulting 7-bit signal. A 7-bit signal RR 2 is generated by performing a logical 
exclusive-OR operation on the outputs of the TR1 730 and the S71 operator 740 
with a sub-encryption key KI, iM . The signal RR 2 is temporarily stored in the first 
register 800. Upon receipt of a first clock signal CLK1 from a controller (not 
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shown), the register 800 simultaneously outputs the 9-bit signal RL 2 and the 7-bit 
signal RR 2 . Thus the register 800 functions to synchronize the output timings of 
signals according to delay involved with encryption in the S91 operator 710, the 
ZE1 unit 720, the TR1 unit 730, and the S71 operator 740. 

5 

In the second ciphering unit, an S92 operator 750 generates a 9-bit signal 
y0, yl, . . ., y8 from the 9-bit signal RL 2 received from the register 800 using Eq. 
(3). A ZE2 unit 760 adds two zeroes to the MSB of the signal RR 2 received from 
the register 800 and outputs a 9-bit signal. An Exclusive-OR operation is 
10 performed to logically "exclusive OR" the outputs of the S92 operator 750 and 
the ZE2 unit 760 to provide a 9-bit signal RL 3 . The signal RL 3 is temporarily 
stored in a second register (register 2) 820. 



Simultaneously, an S72 operator 780 generates a 7-bit signal yO, yl, . . ., 
15 y6 from the 7-bit signal RR 2 (=RR 3 ) using Eq. (4). A TR2 unit 770 removes two 
zeroes from the MSBs of the 9-bit signal RL 3 and outputs the resulting 7-bit 
signal. A 7-bit signal RR4 is generated by performing a logical exclusive-OR- 
operation on the outputs of the TR2 770 and the S72 operator 780. The signal 
RR4 is temporarily stored in the second register 820. 



20 



• . r . 1 n^noi n\ frorn the controller, the 

Upon receipt 01 a scuunu ^iw^iv ai^iui i* — 1 — > 

register 820 simultaneously outputs the 9-bit signal RL 4 and the 7-bit signal RR4. 

Thus the register 820 functions to synchronize the output timings of signals 

according to the delay involved with the encryption in the S92 operator 750, the 

25 ZE2 unit 760, the TR2 unit 770, and the S72 operator 780. 

As described above, the S91 operator 710 and the S92 operator 750 each 
output a 9-bit signal yO, yl, . . ., y8 by performing parallel logical AND 
operations and then performing a logical exclusive-OR operation according to 
30 Eq. (3). The S71 operator 740 and the S72 operator 780 each output a 7-bit signal 
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y0, yl, . . ., y6 by parallel AND operations and then exclusive-OR operation 
according to Eq. (4). Therefore, encryption speed is remarkably increased. 
Furthermore, the use of the registers 800 and 820 for signal timing 
synchronization enables output of an accurate ciphertext. 

5 

In accordance with the present invention, (1) parallel computation of 
input signals increases signal processing speed; (2) due to synchronization of the 
output timings of a delayed signal and a non-delayed signal, an accurate 
ciphertext is achieved and thus an encryption system is further stabilized; and (3) 
10 the decrease in devices used for synchronization reduces required chip capacity 
and production cost. 

While the invention has been shown and described with reference to a 
certain embodiment thereof, it will be understood by those skilled in the art that 
15 various changes in form and details may be made therein without departing from 
the spirit and scope of the invention as defined by the appended claims. 
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